CVE-2022-25278
Drupal core Denial of Service vulnerability
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.
- Record
CVE-2022-25278- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
CVE List
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.
- Record
CVE-2022-25278- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
EUVDEUVD-2023-1267
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.
- Record
EUVD-2023-1267- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cfh2-7f6h-3m85
Access bypass in Drupal Core
Drupal core form API evaluates form element access incorrectly. This can lead to a user being able to alter data they should not have access to.
- Record
GHSA-cfh2-7f6h-3m85- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6ccv-8fgf-cjpw No score
Drupal core Denial of Service vulnerability
The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).
Sites that do not use the Comment module are not affected.
- Record
GHSA-6ccv-8fgf-cjpw- Updated
- 2026-11-02
OSV
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.
- Record
CVE-2022-25278- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-cfh2-7f6h-3m85
Access bypass in Drupal Core
Drupal core form API evaluates form element access incorrectly. This can lead to a user being able to alter data they should not have access to.
- Record
GHSA-cfh2-7f6h-3m85- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-25278
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.
- Record
UBUNTU-CVE-2022-25278- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVBIT-drupal-2022-25278 No score
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.
- Record
BIT-drupal-2022-25278- Updated
- 2026-11-02
OSVCLSA-2026-1784682869 No score
TuxCare security update for drupal/core (21 CVEs)
TuxCare rebuilt drupal/core to address 21 CVEs. Fixed in 8.9.20-p1+tuxcare.
- Record
CLSA-2026-1784682869- Updated
- 2026-11-02
OSVDRUPAL-CORE-2022-013 No score
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to.
No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.
This advisory is not covered by Drupal Steward.
- Record
DRUPAL-CORE-2022-013- Updated
- 2026-11-02
OSVGHSA-6ccv-8fgf-cjpw No score
Drupal core Denial of Service vulnerability
The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).
Sites that do not use the Comment module are not affected.
- Record
GHSA-6ccv-8fgf-cjpw- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/corePackagist |
8.0.0 up to 10.1.8 | 10.1.8 |
drupal/corePackagist |
10.2.0 up to 10.2.2 | 10.2.2 |
drupal/corePackagist |
8.0.0 up to 9.3.19 | 9.3.19 |
drupal/corePackagist |
9.4.0 up to 9.4.3 | 9.4.3 |
drupalBitnami |
8.0.0 up to 9.3.19, 9.4.0 up to 9.4.3 | 9.3.199.4.3 |
drupal/coreTuxCare:Packagist From an advisory covering 20 CVEs |
8.9.20 up to 8.9.20-p1+tuxcare | 8.9.20-p1+tuxcare |
drupal/corePackagist |
8.0.0 up to 9.3.19, 9.4.0 up to 9.4.3, plus listed versions 8.0.18.0.28.0.38.0.48.0.5 Show 45 moreShow less8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1 |
9.3.199.4.3 |
drupal/corePackagist |
8.0.0 up to 10.1.8, plus listed versions 10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4 Show 45 moreShow less10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.78.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.4 |
10.1.8 |
drupal/corePackagist |
10.2.0 up to 10.2.2, plus listed versions 10.2.1 |
10.2.2 |
drupal/corePackagist |
8.0.0 up to 9.3.19, plus listed versions 8.0.18.0.28.0.38.0.48.0.5 Show 45 moreShow less8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1 |
9.3.19 |
drupal/corePackagist |
9.4.0 up to 9.4.3, plus listed versions 9.4.19.4.2 |
9.4.3 |
drupal7Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 7.23-17.24-17.24-27.26-17.26-1ubuntu0.17.26-1ubuntu0.1+esm17.26-1ubuntu0.1+esm27.26-1ubuntu0.1+esm3 |
None known |
drupal7Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 7.38-17.41-17.44-1ubuntu1~16.04.07.44-1ubuntu1~16.04.0+esm17.44-1ubuntu1~16.04.0+esm27.44-1ubuntu1~16.04.0+esm3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-25278 is a medium vulnerability (CVSS 6.5) in Drupal Core, published July 20, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in drupal/core 10.1.8.
References
drupal.org/sa-core-2022-013
github.com/drupal/core/commit/2f76ac716ca8019bc60579fdfc8aa6cd65d57dff
Show 7 moreShow less
nvd.nist.gov/vuln/detail/CVE-2022-25278
ubuntu.com/security/CVE-2022-25278
cve.org/CVERecord?id=CVE-2022-25278
Left out here: 698 versions. The JSON record has them.